: Part of the [[libewf]] library package, [[ewfacquire]] can create evidence files in the EnCase and FTK Imager [[E0*]] (EWF-E01) and SMART s0* (EWF-S01) formats. [[ewfacquire]] calculates an MD5 hash while the data is being acquired. Ewfacquire provides support for byte swapping of media bytes. This is useful for dealing with big endian media on and little endian architectures and vice versa. It also has intelligent error recovery.

+

: Part of the [[libewf]] package, ewfacquire can create evidence files in the [[Encase image file format|Expert Wittness Compression Format]], like EnCase and FTK Imager .E01 (EWF-E01) and SMART .s01 (EWF-S01) formats. ewfacquire calculates an MD5 integrity hash while the data is being imaged. Ewfacquire provides support for byte swapping of media bytes. This is useful for dealing with big endian media on and little endian architectures and vice versa. It also has intelligent error recovery.

−

:https://sourceforge.net/projects/libewf/

+

: http://code.google.com/p/libewf/

; [[Adepto]]

; [[Adepto]]

Line 62:

Line 62:

; [[MacQuisition Boot CD]]

; [[MacQuisition Boot CD]]

: Provides software to safely image [[Macintosh]] drives.

: Provides software to safely image [[Macintosh]] drives.

+

+

; [[OSFClone]]

+

: http://www.osforensics.com/tools/create-disk-images.html

+

: Self booting open source version of Tiny Core Linux using dc3dd with RAW and AFF support.

Hardware imagers

A hardware and software complex tool produced by SalvationDATA that can imaging data from bad sectors,unstable heads and other patient drives,for more information,you can login in the website:http://www.salvationdata.com

Unix-based imagers

guymager supports all relevant forensic formats (dd, ewf, aff). It is very user friendly and faster than known commercial imagers running under Windwos. As it is based on libewf, it supports all the different subformats found in libewf.

Part of the libewf package, ewfacquire can create evidence files in the Expert Wittness Compression Format, like EnCase and FTK Imager .E01 (EWF-E01) and SMART .s01 (EWF-S01) formats. ewfacquire calculates an MD5 integrity hash while the data is being imaged. Ewfacquire provides support for byte swapping of media bytes. This is useful for dealing with big endian media on and little endian architectures and vice versa. It also has intelligent error recovery.

Part of the AFF system, aimage can create files is raw, AFF, AFD, or AFM formats. AFF and AFD formats can be compressed or uncompressed. aimage can optionally compress and calculate MD5 or SHA-1 hash residues while the data is being copied. It has intelligent error recovery, similar to what is in ddrescue.

A program that converts and copies files, is one of the oldest Unix programs. I can copy data from any Unix "file" (including a raw partition) to any other Unix "file" (including a disk file or a raw partition). This is one of the oldest of the imaging tools, and produces raw image files. Extended into dcfldd.